A registration under a stranger's name is said and skipped, not fatal

A module implementing a seat its credential does not (yet) claim registered tools under the seat's
name; the runtime treated them as the module's own, refused to serve another module's key, and the
whole runtime restarted in a loop — postgres on the control node, 2026-10-01, whose credential predated
the claims. Such a registration is now named in the log and left out; the module's own tools serve.

test/fixtures/store-seat-unclaimed.mjs

@@ -0,0 +1,12 @@
+// A module that is both software and a role: postgres's own tools under its name, and its
+// implementation of the mesh-store seat's verbs under the seat's (novox/hq ADR 0159, 0160).
+import { registerModuleTools } from "@novox/mesh-sdk/tools";
+
+registerModuleTools("postgres", () => [
+  { name: "postgres_create_database", description: "make one", input: {}, run: async () => ({ made: true }) },
+  { name: "databases", description: "postgres's own listing", input: {}, run: async () => ({ software: "postgres" }) },
+]);
+
+registerModuleTools("mesh-store", () => [
+  { name: "databases", description: "what the store holds", input: {}, run: async () => ({ seat: "mesh-store" }) },
+]);

test/membership.test.ts

@@ -195,3 +195,31 @@ test("a mesh that has issued nothing yet gets the derived shape, and says so", a
     await stream.close();
   }
 });
+
+// A module that implements a seat its credential does not (yet) claim is not served for it and does
+// not fall over either: the runtime says so and serves the module's own tools.
+test("a registration under a seat the credential does not claim is said and skipped, not fatal", async (t) => {
+  if (!url) return t.skip("MESH_TEST_NATS unset");
+  resetTools();
+  const stream = await anAssignmentsStream();
+  const credential = { url, node: "anchor", module: "postgres" };
+  const pg = await connectNats(credential);
+  const asker = await connectNats({ url, module: "console", node: "workstation" });
+  const said: string[] = [];
+  const log = console.log;
+  console.log = (...a: unknown[]) => said.push(a.join(" "));
+  let stop = () => {};
+  try {
+    stop = await runTools({ broker: pg, credential, moduleEntrypoints: [fixture("store-seat-unclaimed.mjs")] });
+    console.log = log;
+    assert.ok(said.some((s) => /registers tools under "mesh-store".*not served/.test(s)), said.join("\n"));
+    assert.deepEqual((await callTool(asker, "postgres.databases", {})).result, { software: "postgres" });
+    await assert.rejects(callTool(asker, "seat:mesh-store.databases", {}), /no responders|503/i);
+  } finally {
+    console.log = log;
+    stop();
+    await asker.close();
+    await pg.close();
+    await stream.close();
+  }
+});